Privacy Policy

Scottish Opera (“we”) are committed to protecting and respecting your personal information. Please read this Privacy Statement to understand how we will use or process any personal data we collect from you; why we collect or process it; what we do to keep it secure and your rights if you have any concerns about the information we hold about you and how we use it. We work in accordance with the General Data Protection Regulation 2018, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2013.

We regularly review our practices to ensure that your privacy is appropriately protected. We may update or modify this Privacy Statement from time to time so we recommend you should view it regularly. This Privacy Statement was updated on 25 January 2019.

Scottish Opera is Scotland’s national opera company. We give performances across Scotland and beyond, and provide an extensive education and outreach programme for people of all ages. We are a registered charity and a company limited by guarantee. Scottish Opera is the data controller of the personal information you share with us.

Scottish Opera is registered at the Information Commissioner’s Office. Our data protection registration number is Z4805469

If you have questions about your personal information or how we use it, please contact our Data Protection Controller by email data@scottishopera.org.uk or by phone +44 (0)141 248 4567.

How we collect your personal Information

We collect your personal information when you interact with Scottish Opera:

1. When you sign up to receive emails from us (distributed through Mailchimp).2. When you join us as a member or renew your membership.3. When you make a donation.4. When you visit our website: we use cookies to improve the experience of using our website. This means we will remember your previous visits and track the pages on our website that you visit. Please see section on our Cookie Policy below for more information. 5. When you sign up to participate in one of our education and outreach projects.6. When you tell us information about yourself at meetings, in conversations, etc.7. When you visit our social media channels, including Facebook, Twitter, Instagram and YouTube, we receive the personal information that you share with us according to your privacy settings. To find out more about how these companies process your personal information, we recommend that you read their privacy policies.8. We may get personal information about you from third parties, including the venue box offices where you buy tickets for our performances.9. When you provide goods or services to us, we may collect information about you.

The types of information we collect

We collect information that’s necessary to carry out our business, provide you with services you have requested, keep you informed about our activities and to understand your needs.

Joining our e-newsletter mailing list

When you sign up to receive our e-newsletter mailing through our website, we collect the following information:

First name

Last name

Email address

Joining us as a member or becoming a donor

When you join us or renew as a member, supporter or donor, we collect the following information:

Full name

Postal address

Email address

Phone numbers

Information about your donation or gift

We may also collect additional personal information such as:

Direct debit information

Credit/debit card details

Gift Aid status and gift information

Contact preferences

Current interests, activities and background information

Details of correspondence sent to or received from you

Information you give us when completing any membership or donation forms or when we meet

Information that is publicly available, such as information published in newspapers

Credit / debit card details will only be used for processing your sales transaction or gift. Card details and personal information will be shared with a third-party processor, Worldpay, to authenticate and authorise payments. Direct Debits will be processed through Mosaic or Finastra Bacsactive software. Scottish Opera will not keep your card details once the transaction is complete.

Purchasing a subscription

When you purchase a subscription, we collect the following information (through the box office):• Full name• Postal address• Email address • Phone numbers• Tickets purchased

We may also collect additional personal information such as:• Direct debit information• Credit/debit card details• Contact preferences• Details of correspondence sent to or received from you• Information you give us when completing any subscription form • Information shared with us by a partner organisation, such as ticket booking information shared by our venues and box offices (Theatre Royal Glasgow (ATG), Capital Theatres Edinburgh, Aberdeen Performing Arts and Eden Court Inverness).

Direct Debits will be processed through Mosaic or Finastra Bacsactive software. Credit / debit card details will only be used for processing your sales transaction by the box office.

Participating in Scottish Opera Young Company, Memory Spinners, Community Chorus or other workshops or groups

When you join us to participate in a scheme, project or workshop such as Scottish Opera Young Company, Memory Spinners or Community Chorus, we collect the following information:

Full name

Postal address

Email address

Phone numbers

We may also collect additional personal information as required by the particular participatory group such as:

Credit/debit card details

Date of birth

Name and participation consent of parent or guardian

Emergency contact/next of kin contact details

Medical information

Using our website

When you visit our site, we obtain the following information from your session:

IP address

Please see our Cookies Policy below for more information.

Visiting our premises

We use CCTV in our premises at Elmbank Crescent and Edington Street for security reasons to protect our staff and premises.

How we use your personal information

We use information about you to provide our services to you and manage transactions. You can opt out of, or ask us to change, the way we use this data at any time by contacting us at data@scottishopera.org.uk

E-newsletter mailing list – under GDPR processing basis of consent

When you sign up to receive news and updates from us by email, we will use your information to send you regular newsletters by email to keep you up-to-date with relevant information about Scottish Opera performances, events, news and ways to support our work. We keep a record of the emails we send you, and may track whether you receive or open them so we can make sure we are sending you the most relevant information. We will always provide you with an opportunity to unsubscribe in any emails that we send to you, and will retain your information until you unsubscribe.

Current and recent members and donors: Administrative – under GDPR processing basis of legal obligation

We will use the data we hold about you to keep you informed about your membership status and Direct Debit set-up and renewal information.

Current and recent members and donors: Marketing and Fundraising – under GDPR processing basis of legitimate interest We use your data to:

Ensure that we contact you with information most relevant to you, which may include:

Information relating to your membership or donations, including renewal reminders

Information about performances, events, education events and ways of supporting Scottish Opera, including Play a Supporting Role Appeals

News and updates about Scottish Opera and related matters, including Brio magazine which is sent to current members and donors

Thank you communications for your support or donations, including Christmas cards

Personal invitations to events, and confirmation of event attendance / receipt of payment for an event

Requests to support us in various ways

Current and recent members and donors: Telephone communications – under GDPR processing basis of legitimate interest

We will use the data we hold about you to telephone you for the following purposes. If you are registered with the Telephone Preference Service, we will only telephone you if you have explicitly given consent for us to do so.

To thank you for your support

To provide information about events for members and donors

To invite you to events, including tours, meetings, Education projects and performances

Current and recent members of Friends of Scottish Opera and the Alexander Gibson Circle (AGC): E-mail communications – under PECR basis of soft opt-in.

As a small proportion of your gift to the Friends or AGC incurs VAT, PECR permits the use of email to communicate with you, unless you advise us that you wish otherwise. We will always provide you with an opportunity to unsubscribe in any emails that we send to you, and will retain your information until you unsubscribe. We will use the data we hold about you to send you information for the following purposes:

E-mail communications to thank you for your support and special messages from Scottish Opera to members and donors, such as Christmas Greetings

Information about and invitations to events, including tours, meetings, Education projects and performances

Other current and recent donors (excluding Friends of Scottish Opera and AGC members): E-mail communications – under GDPR processing basis of consent

If you consent to receiving communications from us by email, we will use the data we hold about you to send you information for the following purposes:

E-mail communications to thank you for your support and special messages from Scottish Opera to members and donors, such as Christmas Greetings

Information about and invitations to events, including tours, meetings, Education projects and performances

We will always provide you with an opportunity to unsubscribe in any emails that we send to you, and will retain your information until you unsubscribe.

Gift membership – under GDPR processing basis of consent

If you are given a membership as a gift from another individual, we will ask for your consent to collect and process your information to use as described above for members and donors.

Current and recent Friends of Scottish Opera, Alexander Gibson Circle members and other current and recent members and donors – retention of data

We will retain your data whilst you are a member/donor and for two years beyond this time, at which point we will mark your record as inactive, after which point we will use your data to maintain a record of gifts and essential information but will not use the data to contact you.

Current and recent Subscribers – under GDPR processing basis of legitimate interest

We use your data to:• Process your subscription booking and deliver subscription benefits• Keep you informed about the performances you have booked for, and any changes to these (as and if required)• Send you priority information about forthcoming seasons and events to enable you to take advantage of subscriber priority booking period• Keep you informed about similar events and opportunities to support our

We may use the data we hold about you to send you information for the following purposes:

Information about performances, events and ways of supporting Scottish Opera, including specific fundraising appeals such as Play a Supporting Role

From time to time, we may also use your information to contact you for market research purposes. Participation in any such research is voluntary

We will keep your personal information until you tell us you no longer wish to hear from us.

This information will be held by the venue or box office from which you purchased tickets under the terms of their respective privacy policies.

Participants in Scottish Opera Youth Company, Memory Spinners, Community Chorus and other workshops and groups – under GDPR processing basis of contract

We will only use your personal information to administrate your participation in a Scottish Opera project or workshop and to keep you informed about it. To ensure your wellbeing, we may need to hold sensitive information, including medical information and next of kin contact details. As with all your personal information, this will only be available to those who need it and will be stored securely. We will only keep your personal information until the end of the project or scheme in which you are participating, unless you give us permission to keep it for longer so that we can keep you informed about our activities. Credit / debit card details will only be used for processing your sales transaction. Card details and personal information will be shared with a third-party processor to authenticate and authorise payments. Scottish Opera will not keep your card details once the transaction is complete.

We use CCTV in our premises at 39 Elmbank Cresent, Glasgow G2 4PT and at 40 Edington Street, Glasgow G4 9RD to protect the security of our staff and premises. We keep CCTV footage on our system for 20 days.

Retention of your personal information

We will only keep information that is necessary for our business purposes, and will only keep it for as long as is reasonably necessary for those purposes and to fulfil our legal obligations, for example, to comply with financial auditing requirements and HMRC. The retention period will vary according to the purpose as detailed above (in the section ‘How we use your personal information’). For more information, please contact our Data Protection Controller at data@scottishopera.org.uk.

Sharing your personal information

We will not sell or rent your personal information to any third parties without your prior consent.

From time to time we may engage a third party to provide services on our behalf and, in such cases, we may have to share personal information with them in order for them to do so. In such cases they will use and disclose your information only to the extent necessary to perform that service. These suppliers are currently:

We have agreements in place with these suppliers to ensure that your data is secure and is only used for the purposes we specify and in accordance with this Privacy Statement.

We may share your information with market research service providers, currently Charlotte Wilson Research Services and Baker Richards. Where this research involves automated processing, personal information is anonymised.

We may disclose your personal information where there is a legal requirement on us to do so.

Cookies PolicyWhen you use our website, the web server automatically collects standard information such as your IP address, browser type, operating system and access times. Like many websites, we use cookies. These are small electronic files which are downloaded to your device when you visit a website. The information received is used to monitor the volume, type and pattern of traffic using the site which helps us ensure that our website provides the best possible service to users. Cookies may also be used for remarketing purposes.You can disable cookies in your web browser so your computer will not receive them – for information about cookies and how to manage them, visit http://tools.google.com/dlpage/gaoptout

Please be aware that without cookies you will be unable to view some parts of our site, or it may not function properly.

Cookies used on our site

We use two types of cookies:

Strictly necessary cookiesThese cookies are essential in order to enable you to move around the website and use its features.

Analytical cookiesThese cookies enable us to recognise and count the number of visitors to our site in an anonymous way, and to see how visitors use the site. This helps us to improve how our website works. For this, we use Google Analytics (Google Inc.). These cookies cannot be used to identify you personally. The information generated by the cookie will be transmitted and stored by Google on servers in the United States. Analytical cookies may be used to track the effectiveness of an online advertising campaign. These are used for analysis purposes to help optimise online advertising campaigns and ensure you receive ads that are relevant to you. To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout

Links to other websites

Scottish Opera’s website may contain links to other websites owned and operated by third parties. We cannot guarantee the privacy policies of these websites, and advise you to read the Privacy Statement on any such websites.

Keeping your data safe

Your personal information will be held and processed securely by Scottish Opera or our suppliers mentioned above. We implement robust security technologies, processes and procedures to protect the information we hold from unauthorised access and improper use or disclosure. Access to personal data is strictly controlled, and all members of staff and data processors who have access to personal information are legally obliged to respect its confidentiality. Occasionally we may use service providers located outwith the EEA. Currently we use USA-based data processors Google Analytics provided by Google Inc. and email distributor MailChimp, part of The Rocket Science Group, which is certified to the EU-US Privacy Shield Framework. In such cases, we ensure that any information is transferred securely and disclose your information only to the extent necessary to perform that service. We ensure that these suppliers process your information securely and that your data is only used for the purposes we specify and in accordance with our Privacy Policy.

If required to do so by law, we may need to disclose your details.

Your rights

We are committed to handling your information responsibly and securely. You have the following rights relating to your personal data:

To request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

To request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

To request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Please note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

To object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

To request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

To withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

You can exercise your rights by contacting our Data Protection Controller at

If you are unhappy with how we handle your personal information, you can write to us using the contact details noted above. You have the right to make a complaint to the supervisory authority: please contact the Information Commissioner’s Office (ICO) https://ico.org.uk/concerns or the Independent Panel for Fundraising Standards and Complaints in Scotland.

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.